Unknown Sign-In in Your ChatGPT Security History? How to Tell If It’s Really Someone Else, and What to Lock Down (2026)

Most people open a new security log once, see a city they’ve never visited, and panic. Sometimes that’s the right reaction. Often it isn’t.

ChatGPT now keeps a record of who signed in to your account and what security settings changed. That’s useful, because a ChatGPT account in 2026 can hold far more than chats: connected apps, saved files, health and finance data, and payment details.

Below is how to read the log without overreacting, which entries mean someone else got in, and the order to lock things down if they did.

Inside This Guide

• Where Is ChatGPT’s Security History?
• Is That Unknown Location Really Someone Else?
• What Should You Do If Someone Else Signed In?
• What Could an Intruder Have Seen or Changed?
• What Security History Doesn’t Show
• Tips
• Warnings
• FAQ
• Sources

Where Is ChatGPT’s Security History?

ChatGPT’s Security history, introduced on September 25, 2026, is found on the web under Settings in the Security and login section, and it lists sign-ins, sign-outs, and changes to multi-factor authentication, passkeys, and other security settings.

Each entry shows a time, a location, and device details. OpenAI’s own note adds that “some details may be approximate or unavailable,” as The Decoder’s write-up from September 29, 2026 points out.

1. Open ChatGPT in a web browser and sign in.
2. Click your profile icon, then Settings.
3. Go to Security and login and select Security history.
4. Scroll back through the entries and note anything you don’t recognize.

When I checked the coverage, I noticed that OpenAI only documented the web location. If you can’t find it in the mobile app, use a browser. That’s normal, not a sign your account is different.

Is That Unknown Location Really Someone Else?

An unfamiliar city in ChatGPT’s Security history is often explained by a VPN, a mobile carrier routing traffic through another region, or approximate IP geolocation, while an unknown device type or a security change you didn’t make is a much stronger sign of account takeover.

This part trips a lot of people up. Location is the least reliable field in any sign-in log. Device and action are the ones to trust.

Table: our own triage guide based on the event types OpenAI says Security history records (sign-ins, sign-outs, MFA, passkeys, and other security settings). Checked October 6, 2026.

If you’ve ever used a VPN app on your phone and forgot it was on, you know how this goes. Turn it off, sign in again, and see if the new entry shows your real area.

What Should You Do If Someone Else Signed In?

If ChatGPT’s Security history shows a sign-in or security change you didn’t make, sign out of all sessions first, then change your password, then turn on multi-factor authentication, in that order, so the intruder can’t simply sign back in.

1. Sign out everywhere. ChatGPT’s Active sessions page, in the same Security area of Settings, lets you end single sessions or all of them. Infosecurity Magazine reported in June 2026 that a full sign-out sweep “can take up to 30 minutes.”
2. Change your password. If you sign in with Google, Microsoft, or Apple, change that account’s password instead. That’s where the real key lives.
3. Turn on MFA or add a passkey. If the log shows someone else changed these, remove their passkey and set yours up fresh.
4. Check your email account too. A takeover often starts there. Look up your address on Have I Been Pwned to see if it appeared in a known breach.
5. Come back after 30 minutes and confirm only your current session is listed.

Honestly, step 2 is where most people stop. Don’t. Without MFA, a reused password just gets guessed again.

What Could an Intruder Have Seen or Changed?

Someone with access to a ChatGPT account in 2026 could read past chats and uploaded files, use connected apps and data sources linked to the account, and spend the account’s usage limits, so each of those needs a check after a suspected takeover.

When I compared the features added this year, I found that the list of things worth protecting has grown fast. Here’s what to review, roughly in order of damage:

• Connected financial or health data. If you linked bank accounts or health records, disconnect and reconnect them. Our guide to what ChatGPT Finances can see and how to disconnect it walks through that.
• Connected apps and agents. Look for app connections or agents you didn’t set up. Revoke anything unfamiliar.
• Apps you signed in to with ChatGPT. An intruder could have linked a new one. Our Sign in with ChatGPT guide shows where those connections live.
• Chat history. Scan for conversations you didn’t start. They show what the intruder was after.
• Billing. Check your plan and payment history for upgrades you didn’t make.

Most people skip the connected-apps check and regret it. Changing your password doesn’t automatically undo a connection someone else approved.

What Security History Doesn’t Show

Treat the log as a strong clue, not a complete record. There are real blind spots.

• Approximate details. OpenAI says some location and device details may be approximate or missing.
• SSO accounts. Infosecurity Magazine reported that Active sessions isn’t available for accounts using single sign-on through SAML or OpenID Connect. Work accounts like that are managed by your IT team.
• Third-party sessions. The same report says Active sessions doesn’t track third-party app sessions or Codex CLI sessions.
• Unknown history length. OpenAI hasn’t said how far back the log goes, so an older break-in may not appear.

So a clean log is good news. It just isn’t a guarantee.

Tips

• Check Security history once a month. It takes under a minute and catches problems early.
• Rename or remember your devices. Knowing that “Chrome on Windows” is your work laptop makes the log easy to read.
• Use a passkey if you can. It can’t be phished the way a password can.
• If you handle sensitive data in ChatGPT, look at Lockdown mode. It limits how far ChatGPT reaches into the web and outside services.

Warnings

• Don’t panic over one odd city. Check the device and action fields first.
• Don’t click “security alert” emails that ask you to sign in through a link. Open ChatGPT yourself and check the log there.
• Signing out everywhere doesn’t revoke connected apps. Do both.
• If you shared your login with someone, assume their devices will show up. Shared accounts make this log much harder to trust.

FAQ

Can I see ChatGPT’s Security history in the mobile app?

OpenAI documented the web location only: Settings, then Security and login, then Security history. If you don’t see it in the app, open ChatGPT in a browser on your phone or computer.

Why does ChatGPT show a sign-in from a city I’ve never been to?

Locations are approximate and based on network data. VPNs, mobile carriers, and work proxies often place you in another city. Check whether the device matches one you own before assuming a break-in.

How long does signing out of all ChatGPT sessions take?

Infosecurity Magazine reported that a full sign-out sweep can take up to 30 minutes. Wait, then check Active sessions again to confirm only your current session remains.

Sources

• The Decoder — ChatGPT’s new security history logs your sign-ins, MFA changes and passkeys (September 29, 2026)
• Infosecurity Magazine — OpenAI Unveils ChatGPT Account Security Controls (June 8, 2026)
• Have I Been Pwned — Check if your email address has been exposed in a data breach

Fact-checked against OpenAI’s announcement as reported by The Decoder and Infosecurity Magazine, as of October 6, 2026. ChatGPT settings names and locations can change; check the Security section of Settings if a path differs.